Universal Portals

Auth0 Universal Portals is a hosted identity experience platform. It lets you deploy pre-built, fully managed portals that offer profile management, organization settings, and more. You do not need to write code, host infrastructure, or maintain custom UI. Universal Portas allows you to create Auth0 hosted self-service portals using My Account API for personal settings, or My Organization API for organization management.

Use cases

Universal Portals supports the following use cases:

Create self-service consumer portals to give end-users access to their account profile management, multi-factor authentication (MFA) enrollment, password changes, and security settings. This use case replaces the My Account page that you need build from scratch in your application.

Create self-service business portals to give organization members control over their organization’s configuration, domain verification, and team management. This use case replaces the My Organization page every B2B application builds from scratch.

Key features

Universal Portals provides the following with no need to build, configure, or maintain:

A Visual builder: to configure portal pages using a drag-and-drop editor. It includes:
- Identity components: use pre-built Universal Components for profile management, MFA enrollment, password changes, and organization settings.
- Auth0 Forms: use forms in portal pages to collect information from end-users, such as profile updates, policy acceptance, and marketing communication preferences.
- Layout components: add sections, dividers, and other structural elements to arrange pages visually.
Portal and application: every portal is backed by an Auth0 Regular Web App.
- When you create a portal using the Auth0 Dashboard, Auth0 creates and configures the application automatically, callbacks, logout URLs, API access, and grants are all wired up.
- You can also provision these resources manually using the Auth0 CLI or the Management API, and link the application during portal creation. To learn more, read Universal Portals Quickstart.
Branding inheritance: portals inherit your tenant’s branding settings - logo, colors, and fonts - automatically. In B2B scenarios, branding adapts to the organization context.
Zero infrastructure: portals are fully hosted by Auth0. There is nothing to deploy, scale, or maintain.
Security defaults: Universal Portals implements identity security best practices by default:
- Backchannel logout when a session ends for any reason (logout from another device, session revocation, account changes), the portal session is automatically terminated across all devices.
- Automatic MFA step-up when a user accesses a sensitive operation, the portal handles the authentication challenge transparently and retries the original operation on success.

How it works

Universal Portals allows your authenticated users to visit a portal from within your application. When they navigate to the portal URL, the portal server performs an Auth0 Single Sign-On, this happens transparently with no login prompt. Auth0 issues an access token and a refresh token, which are stored server-side, the browser receives only an encrypted session cookie. As the user navigates between sections, the portal server uses the refresh token to obtain a fresh access token scoped to only the resource that section needs. The refresh token issued at login can be exchanged for access tokens for different audiences, such as the My Account API for personal settings, or the My Organization API for organization management. In the diagram below, the user navigates to the security section to manage their authentication methods, which requires the My Account API.

Step-up challenges

Some operations require a higher level of assurance. When a user attempts a sensitive action, such as deleting an authenticator, which requires the delete:me:authentication_methods scope, Auth0 signals that a step-up challenge is required. Universal Portals handles this automatically, it presents the step-up challenge, and retries the original operation once the user completes it.